diff --git a/src/node/routes/index.ts b/src/node/routes/index.ts
index 78e30566867d..4896c59d0cb9 100644
--- a/src/node/routes/index.ts
+++ b/src/node/routes/index.ts
@@ -90,7 +90,8 @@ export const register = async (
     // TODO: This does *NOT* work if you have a base path since to specify the
     // protocol we need to specify the whole path.
     if (args.cert && !(req.connection as tls.TLSSocket).encrypted) {
-      return res.redirect(`https://${req.headers.host}${req.originalUrl}`)
+      const host = String(req.headers.host || "").replace(/[^\w.\-:[\]]/g, "")
+      return res.redirect(`https://${host}${req.originalUrl}`)
     }
     next()
   })
diff --git a/src/node/routes/pathProxy.ts b/src/node/routes/pathProxy.ts
index 4f84b3f87e71..8033d8890386 100644
--- a/src/node/routes/pathProxy.ts
+++ b/src/node/routes/pathProxy.ts
@@ -15,7 +15,7 @@ const getProxyTarget = (
   const base = (req as any).base || ""
   // Cast since we only have one port param.
   const port = parseInt(req.params.port as string, 10)
-  if (isNaN(port)) {
+  if (isNaN(port) || port < 1024 || port > 65535) {
     throw new HttpError("Invalid port", HttpCode.BadRequest)
   }
   return `http://0.0.0.0:${port}${opts?.proxyBasePath || ""}/${req.originalUrl.slice(base.length)}`